BlackBerry exec bashes Samsung, says the company is still ‘battle testing its enterprise platform’

BlackBerry has been busy lately, resurrecting its brand image and hiring a new leadership team. One of the first execs that CEO John Chen brought on board was John Sims to lead the Enterprise Services Business.

With a month under his belt in the BlackBerry culture, Sims has written his thoughts on the company blog and decided to take a few jabs at his main competitor. The title of his note is “Enterprise Mobility Should Not be Risky Business,” taking less than a hundred works to point out a recent report showing disclosing vulnerabilities in Samsung’s enterprise-ready KNOX platform. Sim noted, “With Samsung still battle testing its enterprise platform and fixing security bugs, industries that require the most stringent security needs can trust that there’s nothing more secure than a BlackBerry device managed by a BlackBerry Enterprise Server – period.”

“BlackBerry is unmatched when it comes to security,” said Sims. “With the recent changes in our leadership team and our strong commitment to our customer base in the regulated industries, we aim to continue to be the leader.”

Yesterday saw BlackBerry’s stock increase by 10%, mainly due to a Citron report that the stock will hit $15. After a couple years of getting trashed in the media it seems like BlackBerry is slowly changing analysts’ — and peoples’ — perceptions. The Waterloo-based company has new devices planned for this year, but will target an entry-level BB10 device called Jakarta to emerging markets. No indication yet on when its next flagship BB10 device will launch.

No pain, no gain. Blackberry needs to be aggressive in this dog eat dog market.

Acer12345

You should also mention that the Pentagon just annouced they’re hooking up 80,000 new and old BlackBerry devices (along with 1800 Android/iOS devices) at the end of this month.

crocop24

I’m sure those old devices will last long.

Skbwolf

“Yesterday saw BlackBerry’s stock increase by 10%, mainly due to a Citron report that the stock will hit $15. ” i could have sworn the stock increased because of the DoD contract they received.

drsquid

They didn’t receive any contract from the DoD. Another company, Fixmo, received a contract in June 2013 to deploy a new MDM solution for the DoD, and yesterday’s news (actually first reported last week) was that the new system would go online at the end of the month. It will initially support 100,000 devices, and of the CURRENT devices the DoD owns that will be hooked up, 80,000 are BlackBerries, most likely OS 7 devices, and the other 1,800 a mix of Android and iOS.

MXH070

You are miss informed, you might want to do a little more reading on your numbers.

drsquid

The original DISA press release from last week states the following:

“DOD will begin deploying version 1.0 of the unclassified mobility capability Jan. 31 and will build out capacity to support up to 100,000 users by the end of the fiscal year.

The program currently supports 1,800 unclassified mobile devices including iPad 3 and 4, iPhone 4S and 5, Samsung 10.1 tablets and Samsung 3S, and Motorola RAZR devices with participation from the combatant commands, services, and agencies throughout DOD. The program also supports 80,000 BlackBerry phones.”

drsquid

That seems pretty clear to me as to the numbers we are talking about.

MXH070

Go a little further and and read that 98% of the devices on this network will be blackberry devices. So the last 2% will be made up of Android and apple devices.

drsquid

The 98% figure doesn’t come from the original press release from DISA, but a nextgov dot com report. It is referring to CURRENT devices. 98% of the current devices to be hooked up to the new MDM system are BlackBerrys. Which is correct, since 80,000 is approx. 98% of 81,800.

MXH070

Bloomberg reported that the agency will add about 80,000 BlackBerrys and roughly 1,800 phones and tablets powered by Apple IOS and Google Android OS to its network at the end of this month.

drsquid

The Bloomberg report was BASED on the information in that press release I quoted!!

To quote the Bloomberg article:

“About 80,000 BlackBerrys will start being hooked up to the department’s management system at the end of this month, the Defense Information Systems Agency said in a statement last week.”

The word ‘statement’ in the above, when viewed on Bloomberg, links directly to the press release I was quoting from. There is nothing mentioned anywhere about any NEW devices being added.

MXH070

Last week the DoD announced that its Defense Information Systems Agency that 98 percent of the devices in one of its new networks will be BlackBerry. Some of the articles didn’t include this part I’ve been getting my info from the stock sites and A few tech sites.

drsquid

See my comment above as to how those sites arrived at the 98% figure. ALL of the reports on this news originate from the DISA press release from Jan 16th 2014. I can’t link to it, but there is no mention of the percentage in the release.

drsquid

There are plenty of articles that back up what I am saying if you Google. Try reading reports from last Thursday on nextgov dot com, federaltimes dot com, and even Fixmo’s original press release from June 2013, when they were originally awarded the contract for the MDM solution.

MXH070

What really blows is people can’t add links it would make thing a whole lot easier. I will check those sites out.

It’s Me

Is there any mention of them being OLD devices?

drsquid

YES – as mentioned above:

“The program *currently* supports 1,800 unclassified mobile devices including iPad 3 and 4, iPhone 4S and 5, Samsung 10.1 tablets and Samsung 3S, and Motorola RAZR devices with participation from the combatant commands, services, and agencies throughout DOD. The program also supports 80,000 BlackBerry phones.”

my emphasis on the word currently. We are talking about devices currently in use, which includes 80,000 BlackBerrys

It’s Me

Which could as easily apply to BB10 devices as the even older OS7 devices.

drsquid

Please see my reply to Skbwolf below with regards to BB10. Thanks

Skbwolf

DISA already said they were setting up the system for 40k B10 phones so i do no think its all os7 phones. i think B10 was the only one approved for data use as well.

drsquid

In Aug 2013 this was announced by BlackBerry:

“U.S. Defense Information System Agency (DISA) has given BlackBerry Z10 and BlackBerry® Q10 smartphones with BlackBerry Enterprise Service 10, the Authority to Operate (ATO) on Department of Defense (DoD) networks.”

“With the ATO, DISA is now developing the infrastructure to support BlackBerry 10 smartphones. DISA is architecting the capacity to support 10,000 BlackBerry 10 smartphones by this fall and 30,000 by the end of 2013 on DoD networks.”

There is no mention anywhere if the DoD actually procured 40,000 BB10 devices last year. If they did, I’m sure BlackBerry would have made sure that we all hear about it.

The new Fixmo MDM solution is not BES, so it’s likely that there may have been plans to deploy BB10 devices and BES10 last summer, but that has now changed.

drsquid

Here is another quote from November 2013 from Lt. Col. Ed Mattison, Army CIO/G-6 cyber security directorate and mobility technical lead:

“Come Jan. 1, those in the Army who want to make the switch from the current legacy BlackBerry devices to the new BlackBerry10 will be able to do so when new servers come online. However, on the same day, an 18-month pilot program that had about 3,500 Android and iOS enabled devices will be transitioning to initial operating capability and will be able to support some 50,000 non-BlackBerry phones.” <— this is likely referring to the Fixmo MDM, that will now support 100,000 devices by fiscal year end.

He then said:

"We expect over the next several years that the majority of users that are currently using BlackBerrys will migrate to an iOS or Android device and they will leave the BlackBerry service and go to the new DISA mobility service,"

Stephen_81

DoD is actually running a Mixed solution of BES10 and FixMo, the announcement in August was saying that FixMo was replacing Goodtechnologies for their NON BlackBerry devices

While FixMo does support BlackBerry 10, the DoD is actively avoiding single source solutions to reduce risk of vulnerabilities and dependencies.

The 80k BlackBerry devices are as you say a majority BB7 devices. but many BlackBerry 10 devices are inside the DoD, Currently the DISA has yet to approve anything but BB7 and BES5, or BB10 and BES10 an ATO on DoD networks. Unless I missed a FixMo solution announcement that says what devices will get ATO under them vs just allowing less critical staff the ability to use other devices without the full controls given to ATO devices.

drsquid

Thanks for clarifying this – that makes sense, and I agree, I am sure there are quite a few BB10 devices at the DoD. However, I still think that the story of 80,000 devices got totally misinterpreted by a LOT of media outlets.

Stephen_81

I agree the story was totally misinterpreted by media outlets, but then again Media outlets have been misinterpreting and misrepresenting facts about BlackBerry for as long as the company has been around.

The nature of the business is more complex than a single headline so bloggers/reporters are at a loss and just make stuff up to get looks.

Josh Brown

That is Funny. They seem to forget the security holes they left open, but are super quick to point at other companies security holes. It is just a publicity stunt. Quit flapping your gums and get to work on something people want to buy.

MXH070

What holes? Enlighten us on them….

Josh Brown

June 18, 2013 — 13:39 GMT

BlackBerry has issued a security advisory notice to those who have bought its flagship Z10 touchscreen smartphone — the first BlackBerry 10 device to launch following the company’s bid for revival, back in February.

The advisory, which was issued earlier this month, notes a bug that relates to BlackBerry Protect, its security and backup utility, rather than the phone’s operating system itself.

According to the advisory, an escalation of privilege vulnerability exists in the software of some Z10 phones that could allow a malicious app to “take advantage” of weak permissions in the in-built security software. This could allow a hacker to gain access to the device’s password, and intercept and prevent the device from being wiped.

The “critical” factor is that the security flaw could dupe the device’s user into installing an app which resets the device password through BlackBerry Protect. Though the device may be in the user’s hands, the device’s data is under the control of the hacker.

MXH070

Let me know how many people were duped into downloading a malicious app.

“Users’ precise location and a unique device identifier were disclosed to advertisers, according to the FTC, without their knowledge. The company’s privacy policy advised that this data was collected, but failed to disclose it was shared with third parties.”

It was not like it was emails or passwords it was a low accuracy location and the IMEI of the phone.

Both of which have a ligitamate use by other apps, people are just stupid and don’t read the permissions that apps ask for.

If the requirements are met for exploitation, an attacker could potentially gain access to, read, or modify data from the BlackBerry Link remote file access folder of the user account under which the BlackBerry Link’s remote file access feature is running.”

gommer strike

Those of you who downloaded brightest fliashlight…oh dearie me.

Bar up your windows, grease up your handrails and oil up the balconies, for the most sophisticated criminals, arriving in helicopters and grappling hooks are at your gates, and their names are Legion.

A vulnerability exists due to a misconfiguration of the JBoss hosting environment in affected BES10 versions and standalone UDS. The BlackBerry Web Service exposes a JBoss interface that allows a legitimate administrator to upload packages and make them available to clients. This JBoss interface functionality is not used in BES10 or UDS. The misconfiguration could allow nonadministrative users to upload packages. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code using the privileges of the BES or UDS administration service account.

Josh Brown

This one is really bad. You could lose control of your device and the hacker would have your password.

BSRT-2013-006 Vulnerability in BlackBerry Protect impacts BlackBerry Z10 smartphone software An escalation of privilege vulnerability exists in affected versions of BlackBerry Z10 smartphones. Under specific conditions, this vulnerability could allow a malicious app to take advantage of weak permissions on a BlackBerry Protect object. Taking advantage of the weak permissions could allow the malicious app to:

Gain the device password if a remote password reset command had been issued through the BlackBerry Protect website.

Intercept and prevent the smartphone from acting on BlackBerry Protect commands, such as a remote smartphone wipe.

The most severe potential impact of this vulnerability requires a BlackBerry Z10 smartphone user to install a specially crafted malicious app, enable BlackBerry Protect, and reset the device password through BlackBerry Protect.

With the device password and physical access to the smartphone, an attacker can:

Access the functionality of the smartphone (including the BlackBerry® Hub, apps, data, and the phone) by unlocking the smartphone.

Unlock the work perimeter on a BlackBerry Z10 smartphone that has BlackBerry® Balance™ technology enabled if the work perimeter password is the same as the device password.

Access the smartphone over a USB tether with either BlackBerry Link or the computer’s file viewer, allowing access to the smartphone’s personal files, contacts, PIM data, and so on. The attacker could also access work perimeter content on BlackBerry Balance smartphones if the work perimeter is unlocked and access over a USB tether is allowed by a policy that the IT administrator sets.

Enable development mode after accessing the smartphone over a USB tether, allowing remote access as a low privilege development user.

Change the current device password, allowing the attacker to deny access to the legitimate user of the smartphone.

Access any other local and enterprise services for which the legitimate user has used the same password as the smartphone’s password.

MXH070

Still waiting on numbers of people that have been affected by this.

Josh Brown

A) The consequences of the two are not even close. I will give you my rough location and IMEI, you give me your password to your Phone and BES login.

B) It could’t affect 100 million because there are not that many BB10’s even made let alone sold. There are 1.5 Million androids a day.

BlackBerry Enterprise connected devices have the controls to protect against consumer vulnerabilities, Which is what Samsung is trying to pull off with Knox, and what Samsung is PUSHING with Knox business pushes.

BES10 has had a single security vulnerability which they announced to users very quickly so that BES admins could block TIFF images from being processed by the email servers. And it was BlackBerry that announced it. Not 3rd party security researchers, which are the ones making Samsungs announcements, just like Apple, and Google keep quiet waiting for a 3rd party announcement. for Consumers it doesn’t really matter as much, And they are consumer focused. To Enterprise They want to know ASAP to do their own prevention whilst waiting for a fix/patch.

BlackBerry’s comment on their Blog wasn’t really as outlandish and bashing as people are making it out to be. It talks directly about a competitive product no allegations are being made and it is contrary to GartnerResearch which is constantly saying that companies need to be looking for BES10 Alternatives. yet when they do they run into security issues.

Josh Brown

All I was saying is that BB10 is not perfect either and BB10 is vulnerable to side loaded apps just like android. I am not arguing which is more secure. Just that if you are going to throw mud make sure you are clean first.

Stephen_81

They didn’t throw mud, they spoke to a competitor who has actively dissed them and actively is going after their customers with sales people.

That said I agree BB10 is FAR FAR from Perfect. but BES10 isn’t BB10. Sadly most people don’t actually understand that BES10 connected BlackBerry is very different from Consumer BlackBerry, just like a BES10 connected iPhone, or Android is very different than a consumer iPhone/Android.

Most reporters haven’t the foggiest idea what it is like to use a secured device and they report out of ignorance.

Josh Brown

How does BES protect against vunerabiliy on bb10? Can’t it still steal key strokes and passwords?

Edit the first post I made was for bes10

Stephen_81

BES10 blocks out the ability to side load apps for starters. Also blocks the ability even to share a picture from your work side to your facebook or twitter.

The features of BES10 and what they control are far to lengthy to like in a comment, you clearly enjoy research go and see the controls that BES 10 provides. even without taking the course you can learn a lot about BES10 and BB10/iOS/Android

BSRT-2013-001 Vulnerabilities in Adobe Flash Player version included with the BlackBerry PlayBook tablet software Jan. 8, 2013

BSRT-2012-003 Vulnerabilities in Adobe Flash Player version included with the BlackBerry PlayBook tablet software Aug. 2, 2012 Updated

MXH070

Ummmm that was adobe that had the vulnerability and BlackBerry made sure to advise all its clients I’ve yet to see a report from the competition the use adobe about possible issues. Those notifications were sent out from BlackBerry once again informing the client. How about listing Samsung / Google / Apple security warnings I’m betting you won’t see any as they only own up to it when the media gets a hold of it. As it’s not common practice for apple / Google / Samsung to notify users of a possible security issues you will be looking a long time as they just pretend it never happened.

Josh Brown

So you addressed one, what about the other 50 on that site? I have never heard about these vulnerability, so who is sweeping it under the rug? Doesn’t Google pay developers $20,000 for finding vulnerabilities so they can fix them? Like I said I am not arguing that KNOX is better than BB10. But there is a length list of exploits and not all from adobe. Also most of the exploits in Android are from side-loaded apps as well, so what is the difference?

G35

why is obama only allowed to use BB again?

Josh Brown

BB7, because it is a very limited OS and that is why it is very secure. Eventually they will switch to something else and I am willing to bet it will be a Android that the US Military is working on to be ultra secure. It makes sense for them too because they can start with AOSP code and modify it how ever they want, they will control the OS and can release thier own security patches, updates, and apps. With BB they have no control over the operating system, it is owned by a foreign company and that company is looking to sell, plus the new CEO has ties to a rival superpower.

G35

Interesting take on that. So that’s why the pentagon just ordered 80000 BB for the end of the month if I’m not mistaken.

Josh Brown

No Read the article. It says they hooked up 80000 BB to their existing system, it says nothing about these BB being new, it says nothing about these being BB10 devices. Read the thread above. The Android system that the US Military is working on is not complete, once it is I bet you will see a quick transition to it.

Josh Brown

I am not trying to argue that KONX is more secure than BB10, all I am saying is that point out others flaws when BB10 is not perfect either.

Cormang

I guess BlackBerry hasn’t noticed the bugs in BES10? or MobileFusion, or BDS, or UDS or whatever it’s called this month.

StevieY

Criticize Samsung for issues on a brand new security suite, meanwhile BB10 has boatloads of its own issues that are making no one buy them. Rogers wouldn’t even sell their newest flagship phone in store yet they carry $100 Android devices that can’t possibly make them any money.

This whole thing is lol

Audrey Burne

Yo Ian you always gotta proofread your articles. Look at this:

“Enterprise Mobility Should Not be Risky Business, taking less than a hundred works to point out a recent report showing disclosing vulnerabilities in Samsung’s enterprise-ready KNOX platform.

“works” instead of words and you’re also missing the second quotation for the title of the note. Pick up your game. You’re writing for the number one mobile news website in Canada.

I dont think Blackberry should comment on anything considering their business is and has been going down the drain for how many years now….?

gommer strike

Why even bother bashing the competition, when Blackberry is clearly the leader in the Enterprise with it’s BES solution, which has been a decade(or more)?

When Blackberry says “we’re returning to our roots” what I expect to see, is precisely that – Blackberry, with it’s unwavering business-like stance, with no need to make any mention of competition, never mind even acknowledge the competition’s existence in their advertising.

I’d like to see more classy, business-oriented media which firmly establishes the empowered businessperson as *the* elite user, and this user without question, uses Blackberry.